mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-28 21:33:52 +00:00
staging: gdm724x: fix use after free in gdm_lte_rx()
commitfc7f750dc9
upstream. The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len. Fixes:61e1210476
("staging: gdm7240: adding LTE USB driver") Cc: stable <stable@vger.kernel.org> Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20220228074331.GA13685@kili Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
55d2078cf0
commit
6dc7b87c62
1 changed files with 3 additions and 2 deletions
|
@ -85,14 +85,15 @@ static void tx_complete(void *arg)
|
|||
|
||||
static int gdm_lte_rx(struct sk_buff *skb, struct nic *nic, int nic_type)
|
||||
{
|
||||
int ret;
|
||||
int ret, len;
|
||||
|
||||
len = skb->len + ETH_HLEN;
|
||||
ret = netif_rx_ni(skb);
|
||||
if (ret == NET_RX_DROP) {
|
||||
nic->stats.rx_dropped++;
|
||||
} else {
|
||||
nic->stats.rx_packets++;
|
||||
nic->stats.rx_bytes += skb->len + ETH_HLEN;
|
||||
nic->stats.rx_bytes += len;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
|
Loading…
Reference in a new issue